{"id":3870,"date":"2026-10-29T16:36:08","date_gmt":"2026-10-29T16:36:08","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3870"},"modified":"2026-10-29T16:36:08","modified_gmt":"2026-10-29T16:36:08","slug":"fake-chatgpt-and-claude-apps-abuse-signed-executables-to-deploy-crypto-miners","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3870","title":{"rendered":"Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto Miners"},"content":{"rendered":"<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEj1ij0gwe-L1jDZxdoUPZ6hpSJnJgMHh2bG8bFF2y8y-dJA9nY0Fr2JOU2i4NaCetGqvTZOtvaRXbZONR6d8ajjMR6DNm_X7OwaVCiH7dPycEN9xGI0psNvPYbwDhpGmUQ4Qyhp5x9fqQ_sgzjcReslK-a-gRS3kFr5_JOns1kkuC6UheDHVb2yaV8EAhIF\/s1700-nu-rw-lo-l85-e365\/claude-hack.jpg\" style=\"display: block;  text-align: center; clear: left; float: left;\"><\/a><\/div>\n<p>Threat actors are delivering malicious loaders and cryptocurrency miners under the guise of artificial intelligence (AI) desktop applications for Anthropic Claude and OpenAI ChatGPT as part of a campaign dubbed <strong>Yoba<\/strong>.<\/p>\n<p>The activity involves creating fake GitHub projects that claim to be desktop applications like GPT-5.6 Sol, GPT-6 Astra, and Claude Opus, only to deliver a malware family called YobaLoader.<\/p>\n<p>\u00abThe malware is placed next to legitimate, signed executables from OpenAI and Anthropic so it can be loaded indirectly, a technique commonly known as DLL sideloading, which is often used to bypass security protections,\u00bb Check Point Research <a href=\"https:\/\/research.checkpoint.com\/2026\/tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries\/\" target=\"_blank\">said<\/a> in an analysis.<\/p>\n<p>To add to the project&#8217;s credibility, the attackers set up GitHub.io pages to describe the capabilities of the software. Although the GitHub projects&#8217; popularity is not manipulated using techniques like ghost networks, signs point to the use of SEO poisoning tactics to ensure that links to them are surfaced on top of search results on Google.<\/p>\n<p>Some of the identified GitHub pages links are below &#8211;<\/p>\n<ul>\n<li>github[.]com\/gpt-5-6\/sol-free-desktop<\/li>\n<li>gpt-5-6.github[.]io<\/li>\n<li>github[.]com\/gpt-5-6\/gpt-5-6.github.io<\/li>\n<li>github[.]com\/gpt-6-astra\/gpt-6-astra.github.io<\/li>\n<li>gpt-6-astra[.]github[.]io<\/li>\n<li>github[.]com\/opus-5-0\/opus-5-0.github[.]io<\/li>\n<li>opus-5-0[.]github[.]io<\/li>\n<\/ul>\n<p>\u00abEach repository uses a different email address (edwardcarlsonmkym[@]outlook[.]com, daxschneiderdjuu[@]outlook[.]com, and rioprestonlfyx[@]outlook[.]com), and the uploader appears to operate in UTC+4, UTC-4, and UTC+3 respectively,\u00bb Check Point said. \u00abThis inconsistency likely reflects a deliberate attempt to obscure the threat actor&#8217;s true operational time zone.\u00bb<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/ai-security-guide-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgasUea1PyqjHgZ4PrtmNHQRiRuIWuKqadF1Y1kDkBQlmLoAduaR0D2D5_AgqPzyreZSALvgtryBe5zD3YTk_Q65XX762OpyZGzSzGT8nzn5QlFoiKE6Dqq8rZUJm2Sn_3-epxU4vcpXR-a9JZKHBO4Bq9_nIlpaEEgDZ0oMEEDi4q9NmkHkHuZofDor0TO\/s728-nu-rw-lo-l85-e365\/nudge-2-d.png\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>Hosted within these repositories are ZIP archives that, among other files, contain two specific components &#8211;<\/p>\n<p><a name=\"more\"\/><\/p>\n<ul>\n<li><strong>Setup.exe<\/strong>, a legitimate signed OpenAI Codex or Claude executable<\/li>\n<li><strong>winmm.dll<\/strong>, a malicious DLL that&#8217;s sideloaded by the executable<\/li>\n<\/ul>\n<p>The DLL is a dropper codenamed YobaDropper, which implements checksum value checks by hashing the basename of its host executable and if it matches a hard-coded value \u00ab0xE6C2F326.\u00bb In other words, the check requires it to be launched under \u00abSetup.exe,\u00bb and fails if the DLL is executed on its own inside a sandboxed environment.<\/p>\n<p>Additional anti-analysis techniques and pre-checks include 200,000 iterations of \u00abSleep(5500),\u00bb which amounts to 12.73 days, and skipping machines whose keyboard layout corresponds to that of Russia, Belarus, Tajikistan, Armenia, Azerbaijan, Georgia, Kazakhstan, Kyrgyzstan, Turkmenistan, and Uzbekistan.<\/p>\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEg9RYLUrzFNOI-8R5aF-IYA_SUIgqOM5wSeOxZGS2cbdVH9SBlb6Lkx51Cdt-ByHGzNltCMN0ue2ncQ6MoVGlW93SlvQs8Op2ZY8E5LzhuTY4fCMhHhPfNch10mH2nJfERUbMQKGLL7VMp07x_Jlc055d9qLRZkzi7tgeeqHNR6GqzMczISO6DNDLIVeIcg\/s1700-nu-rw-lo-l85-e365\/chain.png\" style=\"display: block;  text-align: center; clear: left; float: left;\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEg9RYLUrzFNOI-8R5aF-IYA_SUIgqOM5wSeOxZGS2cbdVH9SBlb6Lkx51Cdt-ByHGzNltCMN0ue2ncQ6MoVGlW93SlvQs8Op2ZY8E5LzhuTY4fCMhHhPfNch10mH2nJfERUbMQKGLL7VMp07x_Jlc055d9qLRZkzi7tgeeqHNR6GqzMczISO6DNDLIVeIcg\/s1700-nu-rw-lo-l85-e365\/chain.png\" alt=\"\" border=\"0\" data-original-height=\"396\" data-original-width=\"1024\"\/><\/a><\/div>\n<p>Another language ID excluded from the infection process is <a href=\"https:\/\/kbdlayout.info\/KBDTT102\/\" target=\"_blank\">Tatar<\/a>. Notably missing from the list is Ukraine, which used to be historically included in such checks.<\/p>\n<p>YobaDropper, for its part, triggers a DLL sideloading chain of its own comprising \u00abwmpdmc.exe\u00bb and \u00abampdui.dll,\u00bb <a href=\"https:\/\/learn.microsoft.com\/en-us\/windows\/iot\/iot-enterprise\/optimize\/removable-packages\/microsoft-windows-media-streaming\" target=\"_blank\">copying the former from its \u00absystem32\u00bb folder<\/a> and placing it in a new directory named \u00abWMProcess\u00bb created under \u00abProgramData.\u00bb<\/p>\n<p>The dropper then extracts and decrypts an embedded payload, and drops it into the same folder as \u00abwmpdui.dll.\u00bb It also establishes persistence by means of a scheduled task that launches the legitimate executable to load the malicious payload.<\/p>\n<p>The second DLL is YobaLoader. It implements the same anti-sandbox technique as YobaDropper, requiring the malware to be run only by \u00abwmpdmc.exe\u00bb by checking the hash against a hard-coded value (\u00ab0x552751E3\u00bb). The loader is responsible for three main tasks &#8211;<\/p>\n<ul>\n<li>Downloads an image from a Telegram channel (\u00abt[.]me\/yoba_fanclub\u00bb).<\/li>\n<li>Uses the last 50 bytes as a seed to generate a domain based on three lists of dictionary words and an integer value in the range 0\u2013999 using a domain generation algorithm (DGA). The end result is domain in the format \u00ab<em>adjective<\/em>&#8211;<em>noun<\/em>&#8211;<em>verb<\/em>&#8211;<em>digit<\/em>.dedyn[.]io.\u00bb<\/li>\n<li>Queries Google&#8217;s DNS-over-HTTPS (DoH) API to obtain a Base64-encoded command from a DNS TXT record by passing the constructed domain as input.<\/li>\n<li>Decrypts the response to obtain the link to fetch the next-stage payload (\u00abfiles.catbox[.]moe\/z5zpy9.dat\u00bb).<\/li>\n<\/ul>\n<p>\u00abBy relying on a DoH service and common file-hosting platforms, the actor aims to bypass passive DNS monitoring and some gateway-based security protections, making their command-and-control traffic harder to distinguish from regular user activity,\u00bb Check Point said.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/network-defense-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjVV2rRkX8tRMF6gCzemvQNpwFwGxRWxY1cJEYfoLLSj1EZYJOlj5WTR77t0i6kELXujYcaHTpRDqTjCbVHH5Pnh7wzxUiKP5j4dsDkWIMlp2bmpZsL0jeAsA_19pHH5UPtyBvNkZdyGEULOAsXPcraMP5CYjQRFefhXRSdEjYkrdcpUnc4ILcvcdEfAauE\/s728-nu-rw-lo-l85-e365\/tl-d.jpg\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>The downloaded payload is then injected into \u00absvchost.exe,\u00bb resulting in the execution of an XMRig cryptocurrency miner.<\/p>\n<p>Evidence indicates that the first GitHub repository was created around July 2026, although the malicious releases were not uploaded until the end of August. What&#8217;s more, early versions of YobaLoader have been found to only exclude Russia from infection, while also incorporating extensive anti-debugging and anti-VM checks, which have since been removed in newer versions.<\/p>\n<p>\u00abThe Yoba campaign shows how attackers can use trusted platforms and the current interest in AI tools to distribute malware in a way that looks believable and harmless at first glance,\u00bb Check Point said. \u00abBy packaging their code together with well-known software names and hosting it on GitHub, they lower the chances that users or basic security checks will immediately flag the files as suspicious.\u00bb<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Threat actors are delivering malicious loaders and cryptocurrency miners under the guise of artificial intelligence (AI) desktop applications for Anthropic Claude and OpenAI ChatGPT as part of a campaign dubbed&hellip;<\/p>\n","protected":false},"author":1,"featured_media":3871,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[383,616,978,9,143,229,3986,150,1038,769],"class_list":["post-3870","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-abuse","tag-apps","tag-chatgpt","tag-claude","tag-crypto","tag-deploy","tag-executables","tag-fake","tag-miners","tag-signed"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3870","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3870"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3870\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/3871"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3870"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3870"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3870"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}